Photo Scrubber: Face Blur Running Fully in the Browser, Built by an AI

What happened

On 29 September 2026, Simon Willison published Photo Scrubber, a small web tool for face blurring and metadata removal. His motivation was personal: he had taken a photograph of some protesters and did not want to share identifiable faces of strangers. He had GPT-6 Astra build the tool, and he labels it experimental.

The stack is the interesting part. According to the post, it uses Google's MediaPipe C++ library, compiled to WebAssembly and shipped through the @mediapipe/tasks-vision package, together with the BlazeFace face detection model. The tool itself is hosted at tools.simonwillison.net/photo-scrubber.

Why the architecture matters

Face detection is a solved, cheap problem. BlazeFace is a lightweight detector family, and Google's MediaPipe documentation lists web among its supported platforms alongside Android, iOS and Python. That is what makes a purely client-side tool practical: the model and runtime load in the page, and the image stays on the user's device.

For a privacy tool this is the right default. A service that asks you to upload a photo of strangers in order to protect those strangers has already defeated its own purpose. Doing the work in the browser removes the upload step, the retention question and the server-side attack surface in one move.

What builders can take from it

• Prefer on-device inference for sensitive inputs. If the data is a photo, a document or a transaction record, ask whether the model can run where the data already lives.
• WebAssembly makes mature C++ libraries reusable. You do not need to rewrite a vision pipeline in JavaScript to ship it in a static page.
• Single-purpose utilities are ideal AI-assisted builds. The scope is narrow, the correct behaviour is easy to check by eye, and the dependencies are well documented.
• Still verify the output. A detector can miss a face. Treat any automated blur as a first pass and check the result before publishing, especially for images where identification carries real risk.

The vibecoding angle

The post is a clean small-scale example of the workflow we write about often: a person with a clear need and a clear acceptance test describes the tool, an AI model assembles it from existing libraries, and the human judges whether it works. The model did not invent a face detector. It wired together established components, which is where AI-assisted development is most dependable.

The caution is the same one Willison signals by calling it experimental. A tool that handles privacy needs its edge cases tested, such as small faces, partial occlusion and crowded scenes, before anyone relies on it. The post does not detail how the metadata removal is implemented, so check what a tool strips before you trust it for that.